vpnclient_ynh/conf/init_ynh-vpnclient

#!/bin/bash
### BEGIN INIT INFO
# Provides: ynh-vpnclient
# Required-Start:    $network $remote_fs $syslog slapd
# Required-Stop:     $network $remote_fs $syslog
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: Start VPN client.
# Description:       Start VPN client.
### END INIT INFO

# Functions
## State functions

has_nativeip6() {
  ip -6 route | grep -q default\ via
}

has_hotspot_app() {
  yunohost app list -f hotspot --json | grep -q '"installed": true'
}

has_ip6delegatedprefix() {
  [ "${ynh_ip6_addr}" != none ]
}

is_ip6addr_set() {
  ip address show dev tun0 2> /dev/null | grep -q "${ynh_ip6_addr}/128"
}

is_serverip6route_set() {
  server_ip6=${1}

  if [ -z "${server_ip6}" ]; then
    false
  else
    ip -6 route | grep -q "${server_ip6}/"
  fi
}

is_openvpn_running() {
  service openvpn status client &> /dev/null
}

is_running() {
  ((has_nativeip6 && is_serverip6route_set "${new_server_ip6}") || ! has_nativeip6)\
  && ((! has_hotspot_app && has_ip6delegatedprefix && is_ip6addr_set) || has_hotspot_app)\
  && is_openvpn_running
}

## Setters

set_ip6addr() {
  ip address add "${ynh_ip6_addr}/128" dev tun0
}

set_serverip6route() {
  server_ip6=${1}
  ip6_gw=${2}
  wired_device=${3}

  ip route add "${server_ip6}/128" via "${ip6_gw}" dev "${wired_device}"
}

start_openvpn() {
  ip6_gw=${1}
  server_ip6=${2}

  if [ ! -z "${ip6_gw}" -a ! -z "${server_ip6}" ]; then
    proto=udp6
    [ "${ynh_server_proto}" == tcp ] && proto=tcp6-client
  else
    proto=udp
    [ "${ynh_server_proto}" == tcp ] && proto=tcp-client
  fi

  cp /etc/openvpn/client.conf{.tpl,}

  sed "s|<TPL:SERVER_NAME>|${ynh_server_name}|g" -i /etc/openvpn/client.conf
  sed "s|<TPL:SERVER_PORT>|${ynh_server_port}|g" -i /etc/openvpn/client.conf
  sed "s|<TPL:PROTO>|${proto}|g" -i /etc/openvpn/client.conf

  if [ -e /etc/openvpn/keys/user.key ]; then
    sed 's|^<TPL:CERT_COMMENT>||' -i /etc/openvpn/client.conf
  else
    sed 's|^<TPL:CERT_COMMENT>|;|' -i /etc/openvpn/client.conf
  fi

  if [[ "${proto}" =~ udp ]]; then
    sed 's|^<TPL:UDP_COMMENT>||' -i /etc/openvpn/client.conf
  else
    sed 's|^<TPL:UDP_COMMENT>|;|' -i /etc/openvpn/client.conf
  fi

  if [ -z "${ynh_login_user}" ]; then
    sed 's|^<TPL:LOGIN_COMMENT>|;|' -i /etc/openvpn/client.conf
  else
    sed 's|^<TPL:LOGIN_COMMENT>||' -i /etc/openvpn/client.conf
  fi

  service openvpn start client
}

## Unsetters

unset_ip6addr() {
  ip address delete "${ynh_ip6_addr}/128" dev tun0
}

unset_serverip6route() {
  server_ip6=${1}
  ip6_gw=${2}
  wired_device=${3}

  ip route delete "${server_ip6}/128" via "${ip6_gw}" dev "${wired_device}"
}

stop_openvpn() {
  service openvpn stop
}

## Tools

moulinette_get() {
  var=${1}

  value=$(yunohost app setting vpnclient "${var}")

  if [[ "${value}" =~ "An instance is already running" ]]; then
    echo "${value}" >&2
    exit 1
  fi

  echo "${value}"
} 

moulinette_set() {
  var=${1}
  value=${2}

  msg=$(yunohost app setting vpnclient "${var}" -v "${value}")

  if [ ! $? -eq 0 ]; then
    echo "${msg}" >&2
    exit 1
  fi
}

# Check configuration consistency

if [[ ! "${1}" =~ stop ]]; then
  if [ ! -e /etc/openvpn/keys/ca-server.crt ]; then
    echo "DISABLED SERVICE: You need a CA server (you can add it through the web admin)" >&2
    exit 1
  fi

  empty=$(find /etc/openvpn/keys/ -empty -name credentials &> /dev/null | wc -l)
  if [ "${empty}" -gt 0 -a ! -e /etc/openvpn/keys/user.key ]; then
    echo "DISABLED SERVICE: You need either a client certificate, either a username, or both (you can add one through the web admin)" >&2
    exit 1
  fi
fi

# Variables

echo -n "Retrieving Yunohost settings... "

ynh_server_name=$(moulinette_get server_name)
ynh_server_port=$(moulinette_get server_port)
ynh_server_proto=$(moulinette_get server_proto)
ynh_ip6_addr=$(moulinette_get ip6_addr)
ynh_login_user=$(moulinette_get login_user)

old_ip6_gw=$(moulinette_get ip6_gw)
old_wired_device=$(moulinette_get wired_device)
old_server_ip6=$(moulinette_get server_ip6)

new_ip6_gw=$(ip -6 route | grep default\ via | awk '{ print $3 }')
new_wired_device=$(ip route | awk '/default via/ { print $NF; }')
new_server_ip6=$(host "${ynh_server_name}" | awk '/IPv6/ { print $NF; }')

if [ -z "${new_server_ip6}" ]; then
  new_server_ip6=$(host "${ynh_server_name}" 80.67.188.188 | awk '/IPv6/ { print $NF; }')
fi

echo "OK"

# Script

case "${1}" in
  start)
    if is_running; then
      echo "Already started"
    else
      echo "Starting..."

      # Run openvpn
      if ! is_openvpn_running; then
        echo "Run openvpn"

        start_openvpn "${new_ip6_gw}" "${new_server_ip6}"

        if [ ! $? -eq 0 ]; then
          exit 1
        fi

        (i=0 && false) || while [ $? -ne 0 ]; do
          sleep 1 && (( i++ ))
          [ ${i} -gt 20 ] && exit 1
          ip link show dev tun0 &> /dev/null
        done
      fi

      # Check old state of the server ipv6 route
      if [ ! -z "${old_server_ip6}" -a ! -z "${old_ip6_gw}" -a ! -z "${old_wired_device}"\
           -a \( "${new_server_ip6}" != "${old_server_ip6}" -o "${new_ip6_gw}" != "${old_ip6_gw}"\
           -o "${new_wired_device}" != "${old_wired_device}" \) ]\
         && is_serverip6route_set "${old_server_ip6}"; then

        unset_serverip6route "${old_server_ip6}" "${old_ip6_gw}" "${old_wired_device}"
      fi

      # Set the new server ipv6 route
      if has_nativeip6 && ! is_serverip6route_set "${new_server_ip6}"; then
        echo "Set IPv6 server route"
        set_serverip6route "${new_server_ip6}" "${new_ip6_gw}" "${new_wired_device}"
      fi

      # Set the ipv6 address
      if ! has_hotspot_app && has_ip6delegatedprefix && ! is_ip6addr_set; then
        echo "Set IPv6 address"
        set_ip6addr
      fi
    fi

    # Update dynamic settings
    moulinette_set server_ip6 "${new_server_ip6}"
    moulinette_set ip6_gw "${new_ip6_gw}"
    moulinette_set wired_device "${new_wired_device}"
  ;;
  litestop)
    litestop=1
  ;&
  stop)
    echo "Stopping..."

    if ! has_hotspot_app && has_ip6delegatedprefix && is_ip6addr_set; then
      echo "Unset IPv6 address"
      unset_ip6addr
    fi

    if is_serverip6route_set "${old_server_ip6}"; then
      echo "Unset IPv6 server route"
      unset_serverip6route "${old_server_ip6}" "${old_ip6_gw}" "${old_wired_device}"
    fi
  
    if is_openvpn_running; then
      echo "Stop openvpn"
      stop_openvpn
    fi

    if [ -z "${litestop}" ]; then
      yunohost app list -f hotspot --json | grep -q '"installed": true'
      if [ $? -eq 0 ]; then
        service ynh-hotspot start
      fi
    fi
  ;;
  status)
    exitcode=0

    if has_ip6delegatedprefix; then
      if ! has_hotspot_app; then
        if is_ip6addr_set; then
          echo "IPv6 address is correctly set"
        else
          echo "IPv6 address is NOT set"
          exitcode=1
        fi
      else
        echo "Hotspot app detected"
      fi
    fi

    if has_nativeip6; then
      if is_serverip6route_set "${new_server_ip6}"; then
        echo "IPv6 server route is correctly set"
      else
        echo "IPv6 server route is NOT set"
        exitcode=1
      fi
    else
      echo "No native IPv6 detected"
    fi

    if is_openvpn_running; then
      echo "Openvpn is running"
    else
      echo "Openvpn is NOT running"
      exitcode=1
    fi

    exit ${exitcode}
  ;;
  *)
    echo "Usage: $0 {start|stop|litestop|status}"
    exit 1
  ;;
esac

exit 0